From

Thank you

Sorry

UPDATE A new variant on the Love Bug email virus comes as a "FWD"
document that is able to automatically alter its subject title. It carries a dangerous
attachment with a ".vbs" extender. The new virus is being called the VBS.NewLove.A
virus, described as a "polymorphic" bug because of its ability to change its subject
title.

While this latest, malicious Visual Basic script appears to be more sophisticated in
some ways than the Love Bug, it is similar enough that many defenses put in place to
stop the previous virus could also help forestall VBS.NewLove.A's spread.

The bug has been reported by antivirus concerns Trend Micro and Symantec, among
others.
Trend Micro said the bug is much more dangerous than the Love Bug, because it goes
through all directories and replaces all existing files with files that are zero bytes
in length. Both Trend Micro and Symantec have issued information and patches for the
bug.

While the new bug is genuine, reports of its spread have been somewhat restricted to
date. Early on Friday, the Pittsburgh-based Computer Emergency Response Team (CERT)
said it had received no direct reports of infections related to this virus. In
contrast, when the Love Bug attacked, by early on the afternoon of the first day CERT
had received reports that more than 300,000 computers at 250 sites had been affected.

"Defenses have been helped by the fact that, coming so soon after 'Love Bug', people
are aware of the threat of .vbs attachments," she said. As of early Friday morning,
Landesman had seen the virus but not had reports from customers of trouble from the
virus.

"It does happen to be quite malicious," she added. "It tries to replace all files on
users' machines. This is more of a search-and-destroy virus. It's not trying to steal
passwords."

In some ways, the virus is decidedly more complex than the earlier bug that called
itself "Love." "It certainly is more complicated," said Command's Landesman. "It has
randomly generated lines of text that are inserted each time it is sent. Essentially
this gives it polymorphic capabilities." This, of course, helps it avoid detection when
users casually view their email slate.

The random-line generator also causes the file to continuously grow in size as it is
sent throughout the globe. "Eventually, the attachment is going to be large enough that
it will certainly alert IT personnel," said Landesman, "It is certainly going to slow
down servers 'if the size of the attachment grows'."

Landesman said that, besides regularly updated antivirus software on the desktop,
content-filtering gateways on the front end are proving a helpful means of alerting
administrators to incursions by malicious code such as VBS.NewLove.A. "You can cause
these filters to stop all .vbs files from entering. This has probably helped limit the
spread of this bug," she noted.

The earlier Love Bug, or Love Letter computer worm, was apparently launched by
youths in the Philippines. It has been gauged as the most expensive and most damaging
virus in history, according to some published estimates. While Philippine authorities
have questioned individuals in the case, no one has yet been charged. In fact, the
incident has come to be seen in some quarters as a showcase revealing the
sophistication of that Asian country's programming community.

In a statement, the FBI said it has opened an investigation into reported
VBS.NewLove.A activity. Landesman of Command Software said there were no clear
indications in the bug script that this was the work of Filipino hackers.

Includes reporting by Jack Vaughan, ITworld.com, and material from IDG News
Service.